Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2002.641 -- COMPAQ SECURITY BULLETIN
SSRT2385 OSIS V5.4 LDAP Module for System Authentication Potential
Security Vulnerability
15 November 2002
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: OSIS v5.4 LDAP Module for System Authentication
Vendor: Compaq
Operating System: HP Tru64 UNIX V4.0G
HP Tru64 UNIX V4.0F
Impact: Increased Privileges
Access Privileged Data
Access Required: Remote
Comment: The PGP signature for the Compaq bulletin was bad, however
AusCERT have verified the authenticity of its contents.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SECURITY BULLETIN: SSRT2385 OSIS V5.4 LDAP Module for
System Authentication Potential Security
Vulnerability
REVISION: 0
NOTICE: There are no restrictions for distribution of this
Bulletin provided that it remains complete and
intact.
RELEASE DATE: 13 November 2002
SEVERITY: High
SOURCE: Compaq Computer Corporation,
a wholly-owned subsidiary of
Hewlett-Packard Company and
Hewlett-Packard Company HP Services
Software Security Response Team
REFERENCE: SSRT2385
PROBLEM SUMMARY:
This bulletin will be posted to the support
website within 24 hours of release to
http://thenew.hp.com/country/us/eng/support.html
Use the SEARCH IN feature box, enter SSRT2385 in
the
search window.
SSRT2385 LDAP (Severity - High)
A potential security vulnerability has been has been
identified in the
Lightweight Directory Access Protocol (LDAP) Module for
System
Authentication from Open Source Internet Solutions
(OSIS) V5.4. Later versions of OSIS have been renamed
Internet
Express for Tru64 UNIX.
The potential vulnerability may result in nonprivileged
users gaining
unauthorized access to files or privileged access on the
system. This
potential vulnerability may be in the form of local and
remote security
domain risks.
VERSIONS IMPACTED:
HP Tru64 UNIX V4.0G
HP Tru64 UNIX V4.0F
NOT IMPACTED:
HP-UX
HP-MPE/ix
HP NonStop Servers
HP OpenVMS
RESOLUTION:
Early Release Patches (ERPs) are now available for
OSIS 5.4 LDAP Module for System Authentication for
HP Tru64 UNIX V4.0F and V4.0G (Cluster and Non-clustered
Systems) that provide a solution to this potential
vulnerability.
NOTE:
Customers running the LDAP Module for System
Authentication
on HP Tru64 UNIX 5.*/TruCluster 5.* should update
to the version included with Internet Express
V5.9 or later.
Please review the README file for each patch prior to
installation.
HP Tru64 UNIX V4.0G/TruCluster Server V1.6:
PREREQUISITE: OSIS V5.4 LDAP Module for System
Authentication
Patch Kit Name: OSISV54_SSRT2385_40G_PATCH.tar
Kit Location:
ftp://ftp1.support.compaq.com/public/unix/v4.0g/
HP Tru64 UNIX V4.0F/TruCluster Server V1.6:
PREREQUISITE: OSIS V5.4 LDAP Module for System
Authentication
Patch Kit Name: OSISV54_SSRT2385_40F_PATCH.tar
Kit Location:
ftp://ftp1.support.compaq.com/public/unix/v4.0f/
After completing the update, HP and Compaq strongly
recommends that you perform an immediate backup of
the system disk so that any subsequent restore operations
begin with updated software. Otherwise, the updates must
be re-applied after a future restore operation. Also, if
at some future time the system is upgraded to a later
patch release or version release, reinstall the
appropriate ERP.
SUPPORT:
For further information, contact HP Services.
SUBSCRIBE:
To subscribe to automatically receive future Security
Advisories from the Software Security Response Team via
Electronic mail:
http://www.support.compaq.com/patches/mailing-list.shtml
REPORT:
To report a potential security vulnerability with any HP or
Compaq supported product, send email to:
security-alert@hp.com
HP and Compaq appreciate your cooperation and patience. As
always, HP and Compaq urge you to periodically review your
system management and security procedures. HP and Compaq
will continue to review and enhance the security features
of its products and work with our customers to maintain and
improve the security and integrity of their systems.
"HP and Compaq are broadly distributing this Security
Bulletin in order to bring to the attention of users of the
affected Compaq products the important security information
contained in this Bulletin. HP and Compaq recommend that
all users determine the applicability of this information
to their individual situations and take appropriate action.
Neither HP nor Compaq warrant that this information is
necessarily accurate or complete for all user situations
and, consequently, neither HP nor Compaq will be
responsible for any damages resulting from user's use or
disregard of the information provided in this Bulletin."
(c)Copyright 2002 Hewlett-Packard Company
Hewlett-Packard Company shall not be liable for technical
or editorial errors or omissions contained herein. The
information in this document is subject to change without
notice. Hewlett-Packard Company and the names of
Hewlett-Packard products referenced herein are trademarks
of Hewlett-Packard Company in the United States and other
countries. Other product and company names mentioned herein
may be trademarks of their respective owners.
- -----BEGIN PGP SIGNATURE-----
Version: PGP 7.0.4
iQA/AwUBPdR92DnTu2ckvbFuEQJq8QCg0/bj+ihA8R+vwN287towNbY93ZsAoIQ+
E5kDxXP+abHCGoYiLn1jUDH4
=xNI8
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/Information/advisories.html
If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business
hours which are GMT+10:00 (AEST). On call after hours
for member emergencies only.
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBPdUQIih9+71yA2DNAQG9jwP/fCABVaLHdEsiLX9aKynnmZw8q5u+03U6
17+v6bcG2GbV5DhW3dcFcqSZwzr2ArLx7FMezIjJqpGWSao5uM9wvPBX0QsQkue/
k3YOspptxPp81g0kTT+/5HH4v4K8jZ436JiQMZ7y6yZlRtSgv2zjudmZ2fSYtRws
Kwr6lI5ajNw=
=PYs4
-----END PGP SIGNATURE-----